Privacy Policy

Tritanium Race Companion

Effective date: 2026-10-12 for new users. For members who joined before 2026-10-12, it takes effect on 2026-10-26, 14 days after we told them about this policy.

This policy explains what data Tritanium Race Companion ("the app") collects, why, who else sees it, and what choices you have. The app is run by Tritanium Race Companion ("we", "us"), which sells it through Whop. It covers members who use the app through Whop, people who try our demo, and anyone who visits our home page or opens a crew page, a print sheet or these legal pages.

To ask us anything about your data, message the Tritanium Race Companion store through Whop's support chat (see Contact). If you don't have a Whop account, you can create a free one to send the message.

The short version

• You sign in through Whop. Whop handles payments. We never see your card details.
• We store the race plans you build so the app can show them back to you.
• We don't sell your data or share it for advertising, and we don't run ads.
• We measure how the app is used with our own usage statistics and Vercel Web Analytics. Neither sets cookies or follows you to other sites.
• You can leave yourself out of usage statistics at any time with "Leave me out of usage stats" at the bottom of every page in the app. We also honor Global Privacy Control.
• If you post on the community board, other members see your post under your forum name.
• You can delete races, templates, your home city, your posts and your race requests in the app. To delete everything else, message us through Whop.

What we collect

From Whop

• When you open the app, Whop tells us your Whop user ID and whether your membership gives you access.
• We use the ID to keep your data separate from everyone else's.
• The app does not receive your card details.
• As the seller on Whop, we can also see what Whop shows sellers in its dashboard, such as your name, email address, purchases and membership status. We use this only to manage memberships and answer your messages. The app does not copy it.

What you enter in the app

• Settings: your unit preference (km or mi), and whether you want to be left out of usage statistics.
• Home city (optional): the place name and coordinates rounded to about 1 km. We use them to estimate travel distance to your races and to tailor your travel tasks. You can remove it at any time.
• Race plans: race name, date, start time, venue and location, checklists, notes, packing lists and gear bags.
• Pacing and fuel: planned splits, nutrition targets and your fuel plan (carbs, sodium and fluid per hour).
• Debriefs: your post-race answers and notes, and the lessons you carry into your next race.
• Relay teams: teammates' names, if you add them.
• Course routes: GPX files you upload. We keep a simplified copy of the route: up to 2,000 points of latitude, longitude and elevation, plus the route name and year from the file. We don't keep the original file or its timestamps.
• Strava route links you add (the route number, and the embed code's token and map view).
• Templates you save.
• Crew share links you create.

Please don't put medical details in notes. If you do, we store them like any other note and only use them to show them back to you.

Community board and race requests

Members can post problems and ideas on the community board, vote on posts, and ask us to add a race to the race list.

What we collect:

• Your forum name. You pick it, or we give you one like "Athlete 1234". It is never taken from your Whop name. You can change it up to 3 times in 30 days, and your posts then show the new name.
• Your posts, including details you add to other members' posts.
• Your votes.
• Reports you send about posts, with the reason and any note.
• Race requests: the race name, sport, distance, place, month or date, and an optional website and note.
• Notices we show you in the app about your posts and requests, for example when a race you asked for is added.
• Limits: counts of your recent posts, edits, votes, reports, requests and name changes, so we can stop spam. If we limit your posting, we keep the limit and our reason until it ends.

Who sees it:

• All members can see posts and the forum names of the people who wrote them. People who are not members, including demo visitors, cannot read members' posts. Demo visitors see a sample board instead.
• Members see how many people voted for a post or asked for a race. Other members never see who voted or who asked.
• Our team sees each race request and report with a short code, never your name or Whop ID. Nobody sees who voted.
• When you request a race, other members can see that it was requested and how many members asked. Only our team sees the website and note on a request.
• We never tell a member who reported their post.

How posts are moderated:

• Our team may reply in public. Replies show as "Tritanium Race Companion team", never a staff member's name.
• Our team may group similar posts, merge or split them, change their status, and hide or remove posts that break our rules. If our team hides a whole issue, the posts in it are hidden with it.
• Some steps are automatic. A post reported by 3 members is hidden until our team reviews it. A new post that reads like an existing issue may be added to it automatically, and you can split yours back out.
• If a post of yours is hidden, you see why when you open it, and you can still delete it. If you think we got it wrong, message us through Whop and we will look again.

What you can do:

• Delete a post: open it, press Delete, then press again to confirm. It is deleted for good. If others voted on its issue, the issue stays without your post, and if the issue's title came from your post, your title goes with it.
• Take back a vote: press the vote button again.
• Withdraw a race request: on My Races, under Race requests, press Withdraw (or Remove, once we've decided on it), then press again to confirm.

Please don't post personal details, yours or anyone else's, such as phone numbers, addresses or health information.

Usage statistics

We keep simple usage statistics to improve the app, to decide which races to add, and to see which campaigns and websites bring people to us. We record:

• What you do in the app: for example opening the app, viewing or adding a catalog race, and which tabs and features you use, such as checklists, the race plan, weather, crew links, print sheets, debriefs, templates and your unit setting.
• Community board and race requests: that you posted (and the post's category), added details, voted, reported a post (and the reason), set a forum name, or sent or joined a race request. Never what you wrote.
• Race search: the words you type into the race list search and how many races matched, so we can see which races people look for and can't find. Anything that looks like contact details is never kept. For place searches we only record how many results came back, never what you searched for.
• Races: which catalog race you view or add, with its sport and distance. For a race you enter yourself, only its country, never its name. When you add a race, also its month, how many days away it is, and whether you started from a saved checklist.
• Home country: if you set a home city, its country, never the place.
• Device type: phone, tablet or desktop. We don't store your full browser details.
• Approximate location: country, region and city. Our host Vercel works these out from your IP address. We never store your IP address.
• How you found us: campaign tags in the link you followed (such as utm_source), the name of the website that sent you (such as instagram.com, never the full address), whether you opened the app inside Whop or directly, and your answer if you choose to answer "How did you find us?".
• The date and time of each event.

How you are identified:

• Members and demo users are linked by a coded ID. We make it from your Whop ID or demo ID with a secret key. The statistics never hold your Whop ID, name or email.
• For each member and demo user we also keep one summary under that coded ID: when you first and last opened the app, your first and last country, your last device type, whether you last used it inside Whop, whether you used the app before usage statistics began, and where you first came from (campaign tags, the referring website and your answer to "How did you find us?").
• Visitors who aren't signed in, for example on our home page, the demo start page, a crew page or a print sheet, get a code that changes every day. Their visits can't be linked from one day to the next.

We never put your race plans, notes, checklists, forum name, posts, crew links or print links into usage statistics, and nothing you type except the race search words above.

Vercel Web Analytics

• Vercel Web Analytics counts page views on our home page, the demo and the app's own pages. It records the page (with IDs and other private parts of the address removed), the referring website, campaign tags, country, device type, operating system and browser.
• It sets no cookies and stores nothing on your device. To tell visitors apart, Vercel makes a code from each request and discards it after 24 hours.
• It never runs on crew pages, print sheets, these legal pages or our staff area.

Map photos for the 3D course map

When a course map needs aerial photos we haven't stored yet, the app may ask our server to fetch and store them. To keep this fair for everyone, we log each of these requests with your Whop user ID (or demo ID), the race and the map view, and limit how many you can make. The log is used only for those limits. Entries are deleted after 30 days.

If you contact us

If you message us through Whop's support chat, Whop stores the conversation under its own policies. We use your messages only to answer you and, for data requests, to keep a record that we handled them.

Technical data

• Vercel hosts the app on servers in Portland, Oregon, USA. When you use the app inside Whop, your requests reach us through Whop's proxy.
• To deliver the app and protect it from abuse, Vercel and Whop process standard technical data, such as your IP address and browser details. Vercel keeps our request logs for up to 1 day.
• Supabase, our database host, keeps its own request logs for up to 7 days. They include the IP address of browsers that load stored map photos from it.
• The app itself never stores your IP address or your full browser details. To slow down abuse, such as too many requests from one place, we use a code made from the IP address with a secret key. For usage statistics that code changes every day and is deleted within 48 hours. For sign-in attempts on our staff area it is kept until 30 days after the last attempt.

The demo

• Anyone with our demo link can try the app without a Whop account.
• Pressing "Start the demo" creates a demo account with a random ID. The ID is saved in one cookie (named __Host-rdc_demo). The cookie is signed so it can't be faked, only our server can read it, and it lasts 30 days from the last time you press Start or Continue. The demo can't work without it.
• Races and checklists you make in the demo are stored on our servers like members' data, under the demo ID. You can delete them in the demo. We also periodically delete demo accounts in which nothing has been saved for 30 days.
• Demo use counts in our usage statistics like members' use, under a coded ID made from the demo ID.
• Demo visitors see a sample community board instead of members' posts. They can't post, vote or send race requests.

What stays in your browser

• The app keeps a copy of race plans you have opened, and any edits not yet saved, in your browser's local storage. This lets you keep working on a weak connection. Edits sync to our database when you are back online.
• If our server refuses an edit (for example, one that is too large), the app keeps that edit in your browser's local storage instead of deleting it.
• Deleting a race in the app also removes its copies from that browser.
• While you write a community post, a draft is kept in that browser tab until you post it or close the tab.
• The app also remembers small choices on that device, such as your light or dark theme, the sport you picked last, notes and announcements you have closed and the size of Strava maps.
• Clearing your browser's site data removes these copies. Any edits that have not synced yet will be lost.
• Nothing in your browser is used for usage statistics.

Cookies and tracking

• The app does not use advertising cookies.
• Our analytics set no cookies and store nothing on your device. That goes for our own usage statistics and for Vercel Web Analytics.
• The demo uses one cookie to keep your demo account (see The demo). Our staff area uses one sign-in cookie for staff.
• We honor Global Privacy Control and the in-app "Leave me out of usage stats" setting (see Your choices and rights).
• Whop may use its own cookies to keep you signed in, under Whop's policies.
• Strava's route maps load only after you tap "Show Strava map". Strava may then set its own cookies (see Who else receives data).

How we use your data

• To run the app and show your plans back to you.
• To check that your membership is active.
• To get weather and place search results for your races.
• To show your crew page and print sheets when you share them.
• To run the community board and race requests, moderate them and prevent abuse.
• Product analytics: to understand how the app is used, so we can improve it and choose which races to add. This includes totals drawn from race plans (see Our team).
• Marketing insight, in aggregate: to see which campaigns and websites bring people to us. We look at totals, such as "40 visitors came from Instagram this week", not at individuals.
• To keep the app secure, fix problems and answer your messages.

We don't use your data for advertising, we don't sell it, and we don't share it with anyone for advertising. We don't make decisions about you from usage statistics.

Who else receives data

Services that run the app for us

• Supabase (database host, US West, Oregon, USA): stores the data listed under "What you enter in the app", community posts and race requests, the map photo request log, and usage statistics. It also stores and serves copies of openly licensed aerial photos for the 3D course map. Your browser loads those from Supabase's network, which sees your IP address and the map area shown, as the photo services below would. Supabase's privacy policy.
• Vercel (hosting, request logs and Web Analytics, USA): runs the app's server and handles every request to the app. Vercel's privacy notice.
• Whop (sign-in, payments, memberships, support chat, and the proxy that shows the app inside Whop): receives what you give Whop directly, plus your requests to the app when you use it inside Whop. Whop's privacy policy.

Supabase and Vercel process data for us, under our instructions. Whop runs your Whop account, payments and chat as its own service, under Whop's terms and privacy policy.

Data services our server calls

• MET Norway (weather forecasts): receives race coordinates only.
• NASA POWER (past race-day weather): receives race coordinates and the race date in past years.
• OpenStreetMap Nominatim (place search): receives the place name you search for.
• Map photo services (USGS The National Map and USDA NAIP imagery, EOX Sentinel-2 cloudless, and national mapping agencies such as IGN France, IGN Spain, PDOK Netherlands, basemap.at, geoportail.lu, Estonia's Land and Spatial Development Board, the German state survey offices and Digitaal Vlaanderen): when a course area's photo isn't stored yet, our server fetches it once from these services. They receive the map area only.

These requests come from our server, not your browser, so these services do not see your IP address.

Services your browser loads directly

When you view a course, your browser loads content straight from these services. They can see your IP address, basic browser details and the map area being shown (around your course), and their own privacy policies apply.

• Strava route embeds (strava-embeds.com). Nothing loads from Strava until you tap "Show Strava map". Strava may then set its own cookies and collect usage data. Strava's privacy policy.
• AWS Terrain Tiles (elevation for the 3D course map).
• Aerial photos for the 3D course map: USGS The National Map and USDA NAIP imagery, EOX Sentinel-2 cloudless, and Esri World Imagery (mostly outside the lower 48 US states, including Hawaii and the US territories). Where a stored copy exists, it comes from Supabase instead (see above). We never store Esri's photos.

The crew page loads none of these. It only offers a Google Maps link, which sends nothing until someone clicks it.

Our fonts are bundled with the app, so no font service sees your visits.

Links to other sites

The app links to Google Maps and Google Flights for directions, hotels and flights. Nothing is sent to Google until you click. When you click, the link includes the race location and, for directions, your home city's coordinates. Google's policies apply on its sites.

Other cases

We may share data if the law requires it, to protect the safety or rights of users or others, or if the business is sold or merged. Any new owner must keep protecting your data as this policy describes.

Our team

• Our team (the owner and a few helpers) works in a separate, password-protected staff area. It has its own web address and never opens inside Whop. Every staff sign-in and every change staff make there is logged.
• Staff see usage statistics as totals. Groups of fewer than 5 people show as "fewer than 5".
• Staff also see totals drawn from members' race plans and settings: which catalog races are planned, race months and race countries, and home countries (never the place). A race name you typed yourself is shown only once 5 or more athletes have a race with the same name. If you leave yourself out of usage stats, you are not counted in these totals.
• Any staff member can open the People list. It shows each person's usage statistics under their code: first and last visit, how often they opened the app, races added, home country, the country of their last visit, device type, how they found us, and their latest events, such as pages and features used, catalog races viewed and race search words. It never shows a name, email, Whop ID, city or address. We use it to spot problems and answer data requests.
• Only the owner can find one person's usage statistics from their Whop ID, only to answer a data request, and each look-up is logged.
• Staff see community posts, reports and race requests, including the website and note on a request, so they can answer and moderate them. Members appear by forum name and a short code, never a name, email or Whop ID. That code is made separately from the code behind your usage statistics, so staff can't match the two.
• In the staff area, staff can't see your race plans, templates, home city, debriefs, notes, route files or crew links, only the totals above.
• The owner can also reach the database directly, to run the app and handle data requests.

Crew links and print links

• A crew link is a secret web address for your support crew. Anyone with the link can see, without signing in: the race name, date, start time and location, the course with crew spots, your planned times, and the crew checklist.
• Nothing else is shared on the crew page: not your other checklists or notes, your uploaded route files, your fuel plan or your post-race debrief.
• Share the link only with people you trust. You can turn it off or reset it at any time. Resetting makes the old link stop working.
• We ask search engines not to list crew pages.
• Print links open your prep sheet outside Whop. Each print link works for one hour. Anyone with a print link can see the full sheet until it expires: all checklists and notes, your planned times, your fuel plan and the lessons from your debriefs. Treat it like the sheet itself.
• We count crew page and print sheet visits in our usage statistics with a code that changes every day, like other visitors who aren't signed in. If you left yourself out of usage statistics, visits to your crew page and print sheets aren't counted either.

Other people's details

• If you add a relay teammate's name or notes about your crew, only add what they are happy for you to share.
• The same goes for posts and race requests. Don't name or describe other people, and never post their contact details.

A tip about GPX files

A GPX recording of your own ride or run can show where it started, such as your home. Trim the file before you upload it if that matters to you.

How long we keep your data

• We keep your data while you have access to the app.
• You can delete individual races, templates, your home city, your posts and your race requests in the app at any time. Deleting a race also turns off its crew link.
• To delete all your data, message us through Whop. We delete it within 30 days of your request, including your usage statistics, posts, votes, race requests and map photo requests.
• If your access ends, we keep your data so your plans are still there if you come back. Ask us and we delete it. We may also delete the data of accounts that haven't been used for 12 months.
• We also delete your data when Whop's terms for app developers require it, for example if the app is removed from Whop.
• Usage statistics: we remove the city after 90 days. After 13 months we delete the records and keep only daily totals, with no coded ID and no city.
• Your usage summary (first and last visit, country, device and where you first came from) stays while you keep using the app, and is deleted 13 months after your last visit.
• Visitor codes: the daily key behind them is deleted after 48 hours, so an old code can't be worked out again. The abuse counters for usage statistics hold only codes and are deleted within 48 hours.
• Community: hidden posts that are not shown again within 90 days are deleted. Reports are kept for 12 months after we resolve them. The counters behind posting, voting, request and name change limits are deleted within 32 days. A limit on your posting is deleted when it ends.
• Map photo request log: entries are deleted after 30 days.
• Staff area: the log of staff actions is kept for 24 months. Staff sign-in records are deleted 30 days after they end, and sign-in limits 30 days after the last attempt.
• Demo data: deleted periodically once nothing in that demo has been saved for 30 days.
• Vercel keeps request logs for up to 1 day and Web Analytics data for up to 12 months. Supabase keeps its request logs for up to 7 days.
• Backups: copies in our database host's backups are overwritten within 7 days.

Your choices and rights

• Leave me out of usage stats. Turn this on at the bottom of any page in the app. It is saved with your account, so it works on every device. From then on we record no usage statistics about you, Vercel Web Analytics stops counting your visits to the app's pages, and you are left out of the staff totals drawn from race plans. To have past records deleted too, message us through Whop.
• Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we record no usage statistics from that browser and Vercel Web Analytics doesn't count it. To be left out on every device, and of the staff totals drawn from race plans, also turn on the setting above.
• Your posts and requests. You can delete them in the app at any time (see Community board and race requests).

Wherever you live, you can ask us to:

• Access your data: we send you a copy.
• Correct your data. You can also edit most of it yourself in the app.
• Delete your data.
• Export your data in a common machine-readable format (JSON).
• Stop using your data for usage statistics. Use the setting above or message us. We stop recording them for you, and on request we delete what we already have.

To make a request, message the Tritanium Race Companion store through Whop's support chat, from the Whop account you use for the app. We may ask you to confirm the request through Whop so we know it is you. We reply within 30 days. We will not treat you differently for using these rights.

California

• We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the last 12 months. Supabase and Vercel process it for us as service providers.
• We don't use sensitive personal information to infer anything about you. If you put health details in a note, we only store them to show them back to you.
• What we collect, where it comes from, why, and how long we keep it:
  • Identifiers: your Whop user ID, the coded ID in usage statistics, and your forum name. From Whop, from you, and made by our server. Used to run the app and the community, and for usage statistics. Kept while you have access, and after that until you ask us to delete them (we may delete them after 12 months without use). Usage statistics as below.
  • Internet or other electronic network activity: pages and features you use, device type, the referring website, campaign tags and race search words. From your browser and our server. Used for product analytics, marketing insight in aggregate, and security. Kept 13 months, then only daily totals with no coded ID. Your usage summary is kept until 13 months after your last visit.
  • Approximate geolocation (not precise): country, region and city worked out from your IP address, and your home city rounded to about 1 km if you add one. From Vercel and from you. Used for usage statistics and travel distance to your races. City in usage statistics kept 90 days, country and region 13 months (your first and last country on your usage summary until 13 months after your last visit). Your home city until you remove it.
  • Commercial information: your membership status. From Whop. Used to check your access. Not stored by the app.
  • User content: race plans, notes, debriefs, posts and race requests. From you. Used to run the app and the community. Kept until you delete it or ask us to.
• You have the right to know, access, correct and delete your personal information, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be treated differently for using these rights. You can use an authorized agent; we may ask the agent for proof that you gave permission.
• Global Privacy Control: we honor it, as described above.
• Do Not Track: the app does not track you across other sites, so it does not change how it works when your browser sends a Do Not Track signal.

Other US states

• If you live in a state with a consumer privacy law (for example Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you can ask to access, correct, delete or get a copy of your personal data.
• You also have the right to opt out of targeted advertising, the sale of your data, and profiling that has legal or similarly significant effects. We do none of these.
• To use your rights, message us through Whop. If we turn down your request, you can appeal by replying "Appeal" in the same chat. We answer appeals within 45 days. If you are still unhappy, you can contact your state's attorney general.

EU, EEA, UK and Switzerland

• Tritanium Race Companion is the controller of your data.
• Our legal bases:
  • Contract: running the app you paid for, including the community board and race requests.
  • Legitimate interests: keeping the app secure and preventing abuse; usage statistics with coded IDs and an opt-out, to improve the app; marketing insight in aggregate, to see which campaigns work; and moderating the board. We have weighed these interests against your rights, and you can object at any time.
  • Legal obligation: when the law requires us to keep or share data.
• Your right to object: you can object to usage statistics at any time with "Leave me out of usage stats" or by messaging us. We then stop, and on request we delete past records.
• You also have the rights listed under "Your choices and rights", the right to restrict processing, and the right to complain to your local data protection authority (in the UK, the ICO).
• We don't make decisions about you based only on automated processing that have legal or similarly significant effects. Some moderation steps are automatic (a post reported by 3 members is hidden until our team reviews it), and you can ask us to look again.
• Your posts and forum name are visible to all members.
• To report a post you believe is illegal or breaks our rules, use the Report button on it or message us through Whop. Anyone can report this way, member or not. If we hide your post, we show you why.

Mexico

• If you are in Mexico, you have rights under Mexico's federal personal data protection law. These include access, rectification, cancellation and opposition (ARCO rights), and withdrawing your consent.
• To use these rights, message us through Whop.
• Primary purposes, needed to provide the app: running the app and your plans, checking your membership, the community board and race requests, security and support.
• Secondary purposes, not needed to provide the app: usage statistics to improve the app, and marketing insight in aggregate. You can refuse them at any time with "Leave me out of usage stats" or by messaging us. Refusing does not affect your access.
• Your data is processed by the providers listed above, some outside Mexico, so we can provide the app.

International transfers

Supabase, Vercel and Whop process data in the United States. If you use the app from another country, your data goes there. When the law requires a safeguard for data leaving the EU, EEA, UK or Switzerland, we rely on the provider's certification under the EU-US Data Privacy Framework (and its UK and Swiss extensions) or on the standard contractual clauses in the provider's data processing terms.

Children

The app is for adults. You must be 18 or older to use it (see our Terms of Service). It is not directed to children under 16, and we do not knowingly collect their data. If we learn that someone under 18 is using the app, we may end their access. If we learn that we hold data from a child under 16, we delete it.

Security

• Your data can only be reached through the app's server, after Whop confirms who you are and that you have access. The exceptions are crew and print links you choose to share, which work for anyone holding the link.
• The database blocks direct public access.
• Data travels over encrypted connections (HTTPS).
• Usage statistics never hold your IP address, Whop ID, name or email.
• The staff area has its own staff accounts. Passwords are stored only as salted hashes. Sessions end after 12 hours, or 60 minutes without use. Repeated wrong passwords lock sign-in, and every staff change is logged.
• No system is perfectly secure. If a breach affects your data, we will tell you as the law requires.

Changes to this policy

We may update this policy. When we do, we change the effective date at the top. For important changes, we tell you in the app or through Whop at least 14 days before they take effect.

Contact

• Tritanium Race Companion, sold through Whop.
• Message the Tritanium Race Companion store through Whop's support chat, on whop.com or in the Whop app. Use it for questions, data requests and reports about posts. If you don't have a Whop account, you can create a free one to send the message.